CVE-2026-84714

*** Pendiente de traducción *** A flaw was found in the automation-controller input-validation<br /> guard sanitize_jinja(). The function uses two regular<br /> expressions to reject user-supplied Jinja, but the patterns<br /> stop at the first interior &amp;#39;}&amp;#39; or &amp;#39;%&amp;#39; character, so a Jinja<br /> expression containing an inner brace (for example an empty<br /> dict) is accepted while remaining valid Jinja. Because<br /> sanitize_jinja() is the sole guard on several launch-time<br /> fields — ad-hoc command module_args, Machine-credential<br /> username / become_method / become_user, and inventory host<br /> names — a low-privileged user can inject Jinja that ansible-core<br /> evaluates in the execution environment. This enables execution<br /> of arbitrary commands in the execution environment (bypassing an<br /> administrator&amp;#39;s AD_HOC_COMMANDS module allowlist) and disclosure<br /> of secrets belonging to credentials the attacker cannot read<br /> (by templating a co-attached credential&amp;#39;s injected environment<br /> variables), across the credential access-control boundary.